Stored XSS in NocoDB via Malicious Attachment MIME Types

Executive Summary

CVE-2026-126269 is a stored cross-site scripting (XSS) vulnerability in NocoDB versions before 2026.09.0. Authenticated users with Editor privileges can inject malicious scripts by uploading attachments with crafted MIME types like text/html;image/png. The payload is stored via the records API and executed when the /dltemp signed URL serves the attachment as HTML, potentially stealing session tokens from localStorage to impersonate victims.

Useful 0 Not Useful 0

Detection Guidance

Check NocoDB versions prior to 2026.09.0 for affected installations. Inspect uploaded attachments for crafted MIME types like text/html;image/png. Monitor network traffic for suspicious /dltemp URL requests serving HTML content.

Useful 0 Not Useful 0

Impact Analysis

An attacker could steal your session tokens, impersonate you, or gain unauthorized access to your NocoDB account. Even users with Editor privileges can exploit this to target other users, including those with higher privileges like base owners or super administrators. The attack requires only Editor role access to upload the malicious attachment.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. Session hijacking may result in data breaches, triggering compliance violations and potential legal penalties due to unauthorized data exposure or modification.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade NocoDB to version 2026.09.0 or later immediately. Remove or restrict Editor role privileges until patched. Implement strict MIME type validation for attachments. Add security headers like X-Content-Type-Options: nosniff.

Useful 0 Not Useful 0